Week of June 30, 2025

A security researcher published a proof-of-concept demonstrating how to evade endpoint detection and response (EDR) systems by loading a signed vulnerable driver using the KDMapper tool. The technique leverages the Bring Your Own Vulnerable Driver (BYOVD) method to gain kernel-level access and bypass security monitoring. This highlights ongoing risks from vulnerable signed drivers in endpoint security.

CVE-2026-4747 is a remote kernel code execution vulnerability in FreeBSD's RPCSEC_GSS implementation. It was discovered by Nicholas Carlini using Claude, and later Claude autonomously developed a working exploit in approximately 8 hours. The exploit achieves a root reverse shell via a stack overflow leading to ROP and shellcode execution.

Security researcher 'therustymate' published a proof-of-concept technique called Native Gadget Programming (NGP) that reconstructs shellcode at runtime from byte fragments found in legitimate Windows system files. The dropper contains only metadata (file paths, offsets, lengths) rather than the shellcode itself, evading static signature-based detection by AV/EDR. This research demonstrates a new method to bypass endpoint security products that rely on file scanning.

A researcher details a technique to evade EDR userland hooks by creating a section object from a clean ntdll.dll, mapping it into a target process, and using its unhooked system calls. This bypasses EDR monitoring that relies on patching ntdll in each process. The method allows attackers to execute syscalls that appear normal to the EDR.

A security researcher released an open-source Android application that detects modifications and bypasses targeting the Google Play Integrity API. The app uses native C++ code with a custom bytecode VM and obfuscation to identify root-hiding modules, key attestation spoofing, and debugging tools. This provides a proof-of-concept for detecting advanced Android tampering techniques that could be used to evade endpoint security checks.